Without signing to a PSP, one could host the DRM file to others and also host a moded version with the DRM file.
The DRM file must be signed to the device within a time limit that starts from the moment you download the DRM file, this is how one can prevent the hosting of software on others sites.
also the DRM has an Application ID that must match the eboot ID